CVE-2020-11024

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

In Moonlight iOS/tvOS before 4.0.1, the pairing process is vulnerable to a man-in-the-middle attack. The bug has been fixed in Moonlight v4.0.1 for iOS and tvOS.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-300 CWE-200

Affected software

Vendor	Product	Versions
moonlight-stream	Moonlight	< 4.0.1

References

https://github.com/moonlight-stream/moonlight-ios/commit/b0149b2fe9125a77ee11fe133382673694b6e8ccPatch, Third Party Advisory
https://github.com/moonlight-stream/moonlight-ios/pull/405Patch, Third Party Advisory
https://github.com/moonlight-stream/moonlight-ios/security/advisories/GHSA-g298-gp8q-h6j3Third Party Advisory
https://github.com/moonlight-stream/moonlight-ios/commit/b0149b2fe9125a77ee11fe133382673694b6e8ccPatch, Third Party Advisory
https://github.com/moonlight-stream/moonlight-ios/pull/405Patch, Third Party Advisory
https://github.com/moonlight-stream/moonlight-ios/security/advisories/GHSA-g298-gp8q-h6j3Third Party Advisory

Timeline

Published: Apr 29, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-110255.4In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code CVE-2020-110265.4In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon CVE-2020-110278.1In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be CVE-2020-110287.5In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specif CVE-2020-110296.1In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site CVE-2020-11036.5An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to c CVE-2020-110305.4In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the CVE-2020-110317.5In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if CVE-2020-110327.2In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a te CVE-2020-110337.2In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when CVE-2020-110346.1In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. CVE-2020-110359.3In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses ra